New Encryption Export Rules Relax Regulatory Burden For Many End-Products But Also Raise Many New Questions

On June 25, 2010, the Administration issued the long-awaited regulations implementing the changes from the last Wassenaar Plenary Session and seeking to reduce the regulatory burden on exporters of encryption products under the ENC license exception. See Encryption Export Controls: Revision of License Exception ENC and Mass Market Eligibility, Submission Procedures, Reporting Requirements, License Application Requirements, and Addition of Note 4 to Category 5, Part 2; Interim Final Rule, 75 Fed. Reg. 36482 (June 25, 2010).

The new rule does not make material changes in the encryption items qualifying for mass market treatment, export for internal use by U.S. subsidiaries or contractors developing new products or the category of “restricted” encryption products described in 15 C.F.R. § 740.17(b)(2), although it does add specified types of encryption technology to paragraph (b)(2) of the ENC license exception. The rule also separates the earlier “unrestricted” category in 740.17(b)(3) into two categories. One of these new categories remains subject to essentially the same treatment as existed under earlier 740.17(b)(3). The other new category no longer requires a 30-day waiting period for review prior to export outside of the Supplement 3 list of countries.

Government Contracts Blog Posted at 10:57 AM on July 12, 2010 by Sheppard Mullin New Encryption Export Rules Relax Regulatory Burden For Many End-Products But Also Raise Many New Questions By Curtis M. Dombek On June 25, 2010, the Administration issued the long-awaited regulations implementing the changes from the last Wassenaar Plenary Session and seeking to reduce the regulatory burden on exporters of encryption products under the ENC license exception. See Encryption Export Controls: Revision of License Exception ENC and Mass Market Eligibility, Submission Procedures, Reporting Requirements, License Application Requirements, and Addition of Note 4 to Category 5, Part 2; Interim Final Rule, 75 Fed. Reg. 36482 (June 25, 2010). The new rule does not make material changes in the encryption items qualifying for mass market treatment, export for internal use by U.S. subsidiaries or contractors developing new products or the category of “restricted” encryption products described in 15 C.F.R. § 740.17(b)(2), although it does add specified types of encryption technology to paragraph (b)(2) of the ENC license exception. The rule also separates the earlier “unrestricted” category in 740.17(b)(3) into two categories. One of these new categories remains subject to essentially the same treatment as existed under earlier 740.17(b)(3). The other new category no longer requires a 30-day waiting period for review prior to export outside of the Supplement 3 list of countries. Defining the items formerly in paragraph (b)(3) that will continue to require review with a 30-day waiting period has necessitated the introduction of a series of new concepts. This new category is now defined as follows: (i) (A) Chips, chipsets, electronic assemblies, filed programmable logic devices; (B) Cryptographic libraries, modules, development kits and toolkits, including for operating systems and cryptographic service providers (CSPs); (C) Application-specific hardware or software development kits implementing cryptography. (ii) Encryption commodities, software and components ... that provide or perform “non-standard cryptography”.... (iii) Encryption commodities and software ... that provide or perform vulnerability analysis, network forensics, or computer forensics characterized by ... (A) Automated network analysis, visualization or packet inspection for profiling network flow, network user or client behavior, or network structure/topology and [sic] adapting in real-time to the operating environment, or (B) Investigation of data leakage, network breaches, and other malicious intrusion activities through triage of captured digital forensic data for law enforcement purposes or in a similarly rigorous evidentiary manner. (iv) Commodities and software and components that activate or enable cryptography functionality in encryption products which would otherwise remain disabled ... 75 Fed. Reg. at 36492. The above items continue to require exporters to wait 30 days before proceeding with export to end users outside of the Supplement 3 countries. The items described in (i), (ii) and (iv) above can be considered for mass market treatment, but exporters must submit them for Commerce Department review. The other items that previously were covered by 740.17(b)(3) may now be exported immediately to all destinations (other than the AT countries) on the authority of new paragraph 740.17(b)(1). Such exports require registration by the exporter and the filing of a self-classification report no later than February 1st of the year following the export. Exporters are also allowed to self-classify such items as mass market if they meet the mass market criteria. Those criteria, found in the Cryptography Note 3 to Category 5, Part II, remain the same. Mass market self-classifications also require self-classification reporting. In addition to these extensive changes, the new regulations delete the earlier definition of “ancillary cryptography” in part 772 and add a new Note 4 to Category 5, Part II that incorporates the introductory portion of the earlier definition (with some significant changes) and removes the “Nota Bene” that provided a list of examples of ancillary cryptography. The text in the earlier definition of ancillary cryptography excluding items whose primary function was “communications” has been revised to exclude items whose primary function is “sending, receiving or storing information.” The examples provided in the Nota Bene have been included in the Background section in the Federal Register notice along with a number of new examples. See 75 Fed. Reg. at 36487-36488. The effect of the new Note 4 is to remove items meeting the terms of the Note from Category 5, Part II entirely. The new regulation also includes a wealth of new text and details concerning registration and reporting procedures and information to be submitted with such registrations and reports. The overall effect of these new regulations will be To reduce somewhat the waiting time required for exporters to non-Supplement 3 countries of encryption end products incorporating standard cryptographic algorithms because these will now qualify for immediate export under new paragraph 740.17(b)(1). However, the extensive wording required to create the new registration and reporting rules and define the new subcategories with differing treatment does mean that exporters will have a significant task analyzing exactly where their products fall and ensuring that they comply fully with the new registration and reporting requirements. The wording of new Note 4 to Category 5, Part II and the additional examples listed in the Background section of the Federal Register notice also raise issues of legal interpretation that will pose a challenge to exporters. There will be many other issues of interpretation arising inevitably from the publication of such extensive changes with the introduction of many new terms and concepts. Although the opportunity to self-classify (b)(1) items as mass market will be a welcome change for some exporters, this will be of practical significance only in the easy cases. Some exporters have been surprised by Commerce interpretations of the mass market definition with regard to their particular channels of retail distribution, and these exporters will be reluctant to self-classify without a clearer definition of what constitutes a “mass market” product. Authored by: Curtis M. Dombek (213) 617-5595 cdombek@sheppardmullin.com

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.